US accuses American of allegedly wiping his phone using a ‘duress’ password during border search

The Justice Department has crossed a line it cannot uncross. By indicting Samuel Tunick for entering a duress password at a border checkpoint, federal prosecutors have turned a security feature into a crime. GrapheneOS built the duress password to protect users from coercion. The government now argues that using it as designed constitutes destruction of evidence. That logic, if accepted, makes every privacy tool a potential felony.

Tunick's phone ran GrapheneOS, a hardened Android variant favored by journalists, activists, and anyone who takes device security seriously. The duress password is not a hack. It is a documented, intentional feature — one that wipes the device when entered under duress. The induction that Tunick "deleted the digital contents" by providing a passcode the software recognizes is circular. He used the software as written. The government disagrees with the software's design. That is not a crime.

The border search exception has always been a constitutional sore spot. Courts have long allowed suspicionless searches at the border on the theory that the Fourth Amendment does not fully apply until a person is admitted. But this case stretches the doctrine until it snaps. Agents pulled Tunick into secondary inspection at Hartsfield-Jackson, denied him counsel, refused to articulate suspicion, then demanded his passcode under the pretext of hunting child exploitation material. His motion to suppress says they had no evidence. They had a hunch — or a target.

Tunick is associated with Defend the Atlanta Forest, a movement opposing the construction of a massive police training complex critics call Cop City. The timing suggests the border search was a fishing expedition disguised as a routine inspection. The government does not need a warrant at the border, it claims. It does not need probable cause. It does not even need to tell the truth about why it is searching. That is a recipe for abuse, and this indictment reads like the first course.

The indictment itself betrays the prosecution's carelessness. "Untied States Code" appears where "United States Code" belongs. A typo in a charging document is minor in isolation. In context, it signals a case built on momentum rather than rigor. The government seized a phone, saw it wipe, and reached for the nearest statute. It did not pause to ask whether a duress password is destruction or self-protection. It charged first.

This matters beyond Tunick. If a duress password becomes a crime at the border, it becomes a crime wherever the government claims border-like authority — which, under current doctrine, extends 100 miles inland from any coast or land crossing. Two-thirds of the U.S. population lives in that zone. The border exception does not stay at the border. It migrates.

GrapheneOS developers did not build the duress password for criminals. They built it for people who face coercion: journalists protecting sources, activists protecting networks, travelers protecting data. The government's position is that anyone who prepares for coercion intends to obstruct justice. That premise inverts the right to security. It says you may have encryption, but you may not have a plan for when someone demands the key.

Tunick's attorneys argue the seizure was unlawful from the start. If a court agrees, the evidence vanishes and the case collapses. But the indictment stands regardless, a marker planted in the ground: use a duress password at a checkpoint, face federal charges. The chilling effect is immediate. Security-conscious travelers must now choose between protecting their data and inviting prosecution. That is not a choice a free society should impose.

The government could have pursued this differently. It could have sought a warrant based on individualized suspicion. It could have respected the right to counsel. It could have acknowledged that a duress password is a known, legitimate feature — not a spoliation tool invented for this moment. It did none of those things. It reached for the broadest authority, the thinnest pretext, the sloppiest indictment.

This case will test whether courts still enforce limits at the border. The Supreme Court has hinted that the border exception is not limitless. Riley v. California required a warrant for cell phone searches incident to arrest. The border is not an arrest, but the privacy interests are identical. A phone holds the contents of a mind. The government wants to rummage through it without cause, and punish the owner for a feature designed to stop exactly that.

Tunick's fight is not about one phone. It is about whether privacy tools remain legal when the government finds them inconvenient. The answer will shape what security means for everyone who crosses a U.S. border — or lives within a hundred miles of one.